CVE-2026-71250: Firefly III: Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding
Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user (with webhooks enabled, which is off by default) to configure a webhook targeting loopback services on the server. Additionally, the validator resolves the target hostname once via gethostbyname() at validation time, but the actual outbound request (StandardWebhookSender.php, via Guzzle) re-resolves the hostname independently at send time, allowing a DNS-rebinding attacker to pass validation against a public IP and have the real request delivered to a private or internal address. The webhook response body is only written to a server-side debug log, not returned to the triggering user, so this is a blind SSRF primitive rather than one with direct response read-back.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71250?
The severity of CVE-2026-71250 is medium with a score of 4.3.
How do I fix CVE-2026-71250?
To fix CVE-2026-71250, ensure to restrict webhook configurations to only valid external URLs and apply necessary patches from Firefly III.
What is the potential impact of CVE-2026-71250?
The potential impact of CVE-2026-71250 includes an authenticated user being able to exploit the webhook functionality to configure a malicious target.
Who is affected by CVE-2026-71250?
CVE-2026-71250 affects instances of Firefly III that have webhook functionality enabled for authenticated users.
What type of vulnerability is CVE-2026-71250 classified as?
CVE-2026-71250 is classified as a Server-Side Request Forgery (SSRF) vulnerability.